Import the maintainer's public key from a source you trust, then run git tag -v with the tag name. Git checks the tag signature and prints the result. A good signature shows that the key holder created that tag. It does not show the code is free of flaws.
Steps
- Get the key from more than one place. Look for a fingerprint on the project's website, in its repository, and in any release notes. If they all match, you have more confidence than from a single copy.
- Import the key into your keyring using the tool matching the signing format the project uses.
- Fetch the tags. Run git fetch with the tags option in your clone.
- Verify.
git tag -v v2.4.0
The git manual describes the verify option as checking the cryptographic signature of the given tags. Read the output: it should name the signer and state the signature is good.
- Check out the tagged commit and build from that, not from a branch tip.
What the result can say
| Output | What it means | What to do |
|---|---|---|
| Good signature, key you recognise | Tag was created by that key | Continue, keep other checks |
| Good signature, key you never verified | Signed by some key, trust unknown | Verify the fingerprint first |
| Bad signature | Tag object does not match its signature | Stop and ask the maintainers |
| No signature found | Tag is unsigned or lightweight | Use another check, such as published checksums |
The trust question is the hard part
A signature check answers "was this signed by that key?" You still have to decide whether that key belongs to the people you think it does. That is why step 1 matters. If the only place you found the fingerprint is the same repository an attacker could have altered, it adds little.
Also remember that a tag can be signed while the commit it points at contains a bad change made by a legitimate but compromised account. Signing records who tagged. It cannot read the code for you.
Combine with other checks
- Compare your clone's tagged commit hash with the one in the project's release notes.
- Verify published checksums or signatures on the built files, not only the tag.
- Scan the dependencies of the tagged commit before you deploy.
Safeguard dependency scanning can help with the last item, and the free scan is at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click into a component and note how many dependencies a tagged release pulls in that a signature on the tag says nothing about.
Quick check
The tag verifies, so is the release safe?
Not necessarily. It shows the tag came from the key holder. The code can still contain bugs or a malicious change from a compromised account.
What if the project does not sign tags?
Look for signed or checksummed release files, or build provenance. If there is nothing, treat the source as unverified and review accordingly.
Sources
Last reviewed: 19 October 2026.
